From 1a9261a923e72f4f223b7e00c980df19c5a1f417 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Thu, 6 Jul 2017 15:40:42 +0200
Subject: [PATCH] android: Catch NullPointerException when parsing invalid
 certificates

---
 .../security/TrustedCertificateEntry.java     | 41 +++++++++++--------
 1 file changed, 25 insertions(+), 16 deletions(-)

diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/security/TrustedCertificateEntry.java b/src/frontends/android/app/src/main/java/org/strongswan/android/security/TrustedCertificateEntry.java
index 5e9873d1b..4a1dc8e5f 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/security/TrustedCertificateEntry.java
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/security/TrustedCertificateEntry.java
@@ -43,29 +43,38 @@ public class TrustedCertificateEntry implements Comparable<TrustedCertificateEnt
 		mCert = cert;
 		mAlias = alias;
 
-		SslCertificate ssl = new SslCertificate(mCert);
-		String o = ssl.getIssuedTo().getOName();
-		String ou = ssl.getIssuedTo().getUName();
-		String cn = ssl.getIssuedTo().getCName();
-		if (!o.isEmpty())
+		try
 		{
-			mSubjectPrimary = o;
-			if (!cn.isEmpty())
+			SslCertificate ssl = new SslCertificate(mCert);
+			String o = ssl.getIssuedTo().getOName();
+			String ou = ssl.getIssuedTo().getUName();
+			String cn = ssl.getIssuedTo().getCName();
+			if (!o.isEmpty())
 			{
-				mSubjectSecondary = cn;
+				mSubjectPrimary = o;
+				if (!cn.isEmpty())
+				{
+					mSubjectSecondary = cn;
+				}
+				else if (!ou.isEmpty())
+				{
+					mSubjectSecondary = ou;
+				}
 			}
-			else if (!ou.isEmpty())
+			else if (!cn.isEmpty())
 			{
-				mSubjectSecondary = ou;
+				mSubjectPrimary = cn;
+			}
+			else
+			{
+				mSubjectPrimary = ssl.getIssuedTo().getDName();
 			}
 		}
-		else if (!cn.isEmpty())
+		catch (NullPointerException ex)
 		{
-			mSubjectPrimary = cn;
-		}
-		else
-		{
-			mSubjectPrimary = ssl.getIssuedTo().getDName();
+			/* this has been seen in Play Console for certificates for which notBefore apparently
+			 * can't be parsed (which SslCertificate() does) */
+			mSubjectPrimary = cert.getSubjectDN().getName();
 		}
 	}